What caused the sudden spike in false positives from Exabeam's User and Entity Behavior Analytics (UEBA) engine yesterday?

Introduction

The sudden spike in false positives from Exabeam's User and Entity Behavior Analytics (UEBA) engine yesterday presents a critical issue that demands immediate attention and thorough analysis. To address this problem, I'll employ a systematic approach to identify, validate, and resolve the root cause while considering both short-term fixes and long-term implications for our product.

My analysis will follow a structured framework, beginning with clarifying questions to gather essential context, followed by a comprehensive examination of potential causes, data analysis, hypothesis formation, and finally, a proposed resolution plan.

Step 1

Clarifying Questions (3 minute)

• I'm noticing the issue is described as "sudden." Would you say this spike occurred within a 24-hour period?

Why it matters: Helps pinpoint the timeframe for investigation. Expected answer: Yes, within the last 24 hours. Impact on approach: Narrow focus to recent changes or events.

• Given the nature of UEBA, I'm wondering about the scale. Are we seeing a 10% increase in false positives or something more dramatic like 100%?

Why it matters: Indicates severity and potential scope of the problem. Expected answer: A significant increase, likely over 50%. Impact on approach: Influences urgency and breadth of investigation.

• Considering UEBA's reliance on behavioral patterns, have there been any recent changes to the baseline behavior models?

Why it matters: Could directly impact false positive rates. Expected answer: No recent changes to models. Impact on approach: If yes, focus on model adjustments; if no, look elsewhere.

• I'm curious about the affected user base. Is this spike uniform across all users or concentrated in specific segments?

Why it matters: Helps identify if it's a global issue or segment-specific. Expected answer: Concentrated in certain user segments. Impact on approach: Target investigation on affected segments if applicable.

• Thinking about system dependencies, have there been any recent updates to data sources feeding into the UEBA engine?

Why it matters: Changes in input data could affect analysis accuracy. Expected answer: Some recent updates to data integrations. Impact on approach: Investigate recent data source changes if confirmed.